Out of Band Configuration In Cisco ACI [Step By Step]

Below are the Cisco ACI OOB configuration steps, we will use an example for illustration:

I- Assign static node management address

  • Navigate to: Tenant > Tenant mgmt > Node Management Addresses > Static Node Management Addresses

  • Configure APICs and switches OOB addresses:

Create on the action pane and click Create Static Node Management Addresses:

II- Provide an OOB contract on the Out of Band EPG

Navigate to: Tenant > Tenant mgmt > Node Management EPGs > Out-of-Band EPG default

In the Provided Out-of-Band Contract section, add a contract. We used default, but, It can more specific like an SSH, HTTP contract:

III- Define an External management network instance profile

Navigate To: Tenant > Tenant mgmt > External Management Network Instance Profiles

  • Create External Management Network Instance Profile:

IV- Consume the OOB Contract

Navigate To: Tenant > Tenant mgmt > External Management Network Instance Profiles > Ext_Management_Profile

In Consumed Out-of-Band Contracts, add the contract provided under the OOB EPG:


  • A External Management Network Instance Profile defines which External subnets can have access to ACI OOB management addresses.
  • By defaults all External subnets have OOB access (for initial setup purposes), but, you can limit it here.


Also, you can define multiple External Management Network Instance Profiles. For each one, you will specify different External subnets that will access ACI OOB management and maybe apply different contract for each of them according to your requirements.


And because a picture is better than 1000 words, we can illustrate the OOB configuration in this simple diagram:

OOB Verification on Cisco ACI

Verify OOB on APIC:

  • Check the configured OOB management address on APIC:
ifconfig oobmgmt
  • You can also perform ping and traceroute on APIC to test connectivity.

  • Check APIC management preference:
apic1# bash
admin@apic1:~> route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface UG 16 0 0 oobmgmt UG 32 0 0 bond0.300 

Verify OOB management on Leaf and Spines nodes:

  • You can verify the configured OOB management address on the fabric node:
LEAF123# show ip interface brief vrf management

Interface            Address              Interface Status
mgmt0            protocol-up/link-up/admin-up
  • You can check the routing table:
LEAF123# show ip route vrf management
IP Route Table for VRF "management"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>, ubest/mbest: 1/0
    *via, mgmt0, [0], 04w04d, local
  • You can capture via tcpdump ‘eth0’, which is the oobmgmt interface used on the leaf and spine switches, and uses ‘-n’option for tcpdump to give the IP addresses used instead of the DNS names, and then filtering specifically for NTP packets (UDP port 123).
tcpdump -n -i eth0 dst port 22


5 1 vote
Article Rating
Notify of
Inline Feedbacks
View all comments
Would love your thoughts, please comment.x